Analysis
-
max time kernel
188s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 22:23
Static task
static1
Behavioral task
behavioral1
Sample
8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe
Resource
win7-20220812-en
6 signatures
150 seconds
General
-
Target
8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe
-
Size
378KB
-
MD5
f0c96682156bf5e3d203bd475a7238a8
-
SHA1
df6a26935cc0e14ba021760fb311fb4d8415196c
-
SHA256
8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a
-
SHA512
16731b091fe8082f10b30e1ec56efdc1b150f1117547e51f81cd3b8437bac56213e05c4c0ebb259a00a3d067dfa45db4dd42e404bbd06f8bacd74099d8e92203
-
SSDEEP
6144:mPR/t8jWHOJPhhHU1PgvVqgVIO9mZuITtOMDfeKQK38KyarXXW0aUSSdl:c8jIshhHYPuVGTlDGKDyGXW0aZk
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe File opened for modification C:\Windows\assembly\Desktop.ini 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1344 set thread context of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe File created C:\Windows\assembly\Desktop.ini 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe File opened for modification C:\Windows\assembly\Desktop.ini 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 720 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe Token: SeDebugPrivilege 720 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 720 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85 PID 1344 wrote to memory of 720 1344 8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe"C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe"C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe"2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:720
-
Network
-
Remote address:8.8.8.8:53Request176.122.125.40.in-addr.arpaIN PTRResponse
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
260 B 5
-
260 B 5
-
104 B 2